1. Field of the Invention
This invention pertains generally to computer virus prevention systems. More particularly, the invention is an enhanced system and method for virus detection and removal for network-based systems which provides for virus inspection upon document check-in.
2. The Prior Art
With the growth of computer networks, such as local area networks (LANs), wide area networks (WANs), and the global information network known as the Internet, the need for securing data on such networks has also grown. Among other things, securing the networks and computers participating in the networks against computer viruses has been a priority for network administrators and computer users.
Virus detection and removal software systems (“anti-virus” software) for protecting computer systems and computer networks are known in the art. Such anti-virus software is generally available as commercial products from such software developers as Norton™, McAfee™, IBM®, and Symantec™, among others. Other anti-virus software is also available in the form of shareware or freeware.
Existing anti-virus software comprises two general types: stand-alone versions and network (or server) versions. Stand-alone versions are configured to operate on and protect data on a single node on the network, while network versions are configured to operate on and protect data on one or more network servers, as well as other network nodes.
In operation, both versions of anti-virus software periodically check files on a computer or network of computers to detect and remove viruses. While varying from one implementation to another, the anti-virus software according to the prior art generally operates (i.e., carries out detection and removal) during one or more of the following events: boot up of a computer, shut down of a computer, and introduction of new media (e.g., floppy diskette or CD-ROM). The anti-virus software may also be configured to operate at scheduled intervals (e.g., every day at 2:00 A.M.).
With the threat of virus infection via email documents, some anti-virus software applications provide detection and removal of viruses contained with email messages and email attachments. While effective for most computer and network applications, prior art anti-virus solutions have certain disadvantages, which are overcome by the present invention.
In the domain of shared-document systems (such as electronic document control systems), the threat of virus infection is also realized, particularly, where the document system includes a plurality of users submitting and updating documents and/or files at a rapid rate. For example, where a document infected with a virus is posted to a share-document system, other users of the system who download the infected file are at risk of infecting the user's local machine. A system running anti-virus software which is schedule to operate during start-up or shut-down would not be able to detect the infected file, because the file upload occurs during operation of the system and not during the start-up or shut-down.
In the case where the anti-virus application is scheduled to operate at predetermined intervals, there is a risk that the infected file may not be checked prior to download by another user, particularly, if the scheduled interval for virus checking is large in comparison to the interval between upload and download transfers by users of the system. Since the files uploaded by users of the systems are communicated over the network, rather than via “new media” (e.g., floppy diskette or CD-ROM), files associated with user uploads are not inspected for viruses.
In light of these deficiencies in prior art anti-virus implementations, and since viruses are now capable of residing in data documents (e.g., Microsoft® Word documents via macros) as well as executable files, virus infections poses even more risk to data integrity for network systems and users of such systems.
Accordingly, there is a need for a method and apparatus which provides for anti-virus protection upon document check-in for network systems, and in particular, shared-document systems. The present invention satisfies these needs, as well as others, and generally overcomes the deficiencies found in the background art.